You'll notice
Useful3 Signal3
A hostile plugin name can no longer inject escape codes into failure messages in your terminal.
What's wrong with this entry?
Anonymous. No account, no email.
What
The summary that lists up to two failed plugins with s.reason || s.error || "unknown error" now strips control and bidirectional-text characters from each plugin name and truncates it at 200 characters, so a hostile name cannot inject terminal escape sequences.
Details
- A related plugin path helper gained a
PathUnverifiableErrorclass carrying acode.
Evidence
unknown error
Strings lifted out of the shipped bundle, so the claim above can be checked against them.